AppleCVE-2026-86977

Apple iOS and iPadOS: improper authorization

CVE-2026-86977 · Published Oct 20, 2026 · updated Oct 29, 2026

High7.5

Fix: upgrade to 27 or later

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.

Affected versions

Package	Affected	Fixed in
iOS and iPadOS Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-863

More Apple advisories

All Apple

Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86940fixed in 27 Medium 5.5Oct 20

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86944fixed in 26.7 +2 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86948fixed in 27 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86949fixed in 27